Skip to content

Commit 4d2415d

Browse files
minjieqiuminjieqiu
committed
Remove password retrieval from podexec
1 parent 9c81373 commit 4d2415d

File tree

5 files changed

+100
-21
lines changed

5 files changed

+100
-21
lines changed

‎pkg/splunk/enterprise/afwscheduler.go‎

Lines changed: 48 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -179,6 +179,12 @@ var addTelApp = func(ctx context.Context, podExecClient splutil.PodExecClientImp
179179
// Create pod exec client
180180
crKind := cr.GetObjectKind().GroupVersionKind().Kind
181181

182+
adminPwd, err := splutil.GetSpecificSecretTokenFromPod(ctx, podExecClient.GetClient(), podExecClient.GetTargetPodName(), cr.GetNamespace(), "password")
183+
if err != nil {
184+
scopedLog.Error(err, "failed to retrieve admin password from pod secret")
185+
return err
186+
}
187+
182188
// Commands to run on pods
183189
var command1, command2 string
184190

@@ -188,14 +194,14 @@ var addTelApp = func(ctx context.Context, podExecClient splutil.PodExecClientImp
188194
command1 = fmt.Sprintf(createTelAppNonShcString, telAppConfString, telAppDefMetaConfString)
189195

190196
// App reload
191-
command2 = telAppReloadString
197+
command2 = fmt.Sprintf(telAppReloadString, adminPwd)
192198

193199
} else {
194200
// Create dir on pods
195201
command1 = fmt.Sprintf(createTelAppShcString, shcAppsLocationOnDeployer, shcAppsLocationOnDeployer, telAppConfString, shcAppsLocationOnDeployer, telAppDefMetaConfString, shcAppsLocationOnDeployer)
196202

197203
// Bundle push
198-
command2 = fmt.Sprintf(applySHCBundleCmdStr, GetSplunkStatefulsetURL(cr.GetNamespace(), SplunkSearchHead, cr.GetName(), 0, false), "/tmp/status.txt")
204+
command2 = fmt.Sprintf(applySHCBundleCmdStr, GetSplunkStatefulsetURL(cr.GetNamespace(), SplunkSearchHead, cr.GetName(), 0, false), adminPwd, "/tmp/status.txt")
199205
}
200206

201207
// Run the commands on Splunk pods
@@ -741,10 +747,16 @@ func installApp(rctx context.Context, localCtx *localScopePlaybookContext, cr sp
741747
worker.appDeployInfo.AppPackageTopFolder = appTopFolder
742748
}
743749

750+
adminPwd, err := splutil.GetSpecificSecretTokenFromPod(rctx, worker.client, localCtx.podExecClient.GetTargetPodName(), cr.GetNamespace(), "password")
751+
if err != nil {
752+
scopedLog.Error(err, "failed to retrieve admin password from pod secret")
753+
return err
754+
}
755+
744756
var command string
745757
if worker.appDeployInfo.IsUpdate {
746758
// App was already installed, update scenario
747-
command = fmt.Sprintf("/opt/splunk/bin/splunk install app %s -update 1 -auth admin:`cat /mnt/splunk-secrets/password`", appPkgPathOnPod)
759+
command = fmt.Sprintf("/opt/splunk/bin/splunk install app %s -update 1 -auth admin:%s", appPkgPathOnPod, adminPwd)
748760
} else {
749761
// install the app only if it was not already installed
750762
// we can come to this block if post installation failed
@@ -763,7 +775,7 @@ func installApp(rctx context.Context, localCtx *localScopePlaybookContext, cr sp
763775
return nil
764776
}
765777

766-
command = fmt.Sprintf("/opt/splunk/bin/splunk install app %s -auth admin:`cat /mnt/splunk-secrets/password`", appPkgPathOnPod)
778+
command = fmt.Sprintf("/opt/splunk/bin/splunk install app %s -auth admin:%s", appPkgPathOnPod, adminPwd)
767779
}
768780

769781
streamOptions := splutil.NewStreamOptionsObject(command)
@@ -795,7 +807,13 @@ func isAppAlreadyInstalled(ctx context.Context, cr splcommon.MetaObject, podExec
795807

796808
scopedLog.Info("check app's installation state")
797809

798-
command := fmt.Sprintf("/opt/splunk/bin/splunk list app %s -auth admin:`cat /mnt/splunk-secrets/password`| grep ENABLED", appTopFolder)
810+
adminPwd, err := splutil.GetSpecificSecretTokenFromPod(ctx, podExecClient.GetClient(), podExecClient.GetTargetPodName(), cr.GetNamespace(), "password")
811+
if err != nil {
812+
scopedLog.Error(err, "failed to retrieve admin password from pod secret")
813+
return false, err
814+
}
815+
816+
command := fmt.Sprintf("/opt/splunk/bin/splunk list app %s -auth admin:%s| grep ENABLED", appTopFolder, adminPwd)
799817

800818
streamOptions := splutil.NewStreamOptionsObject(command)
801819

@@ -1736,7 +1754,12 @@ func (shcPlaybookContext *SHCPlaybookContext) triggerBundlePush(ctx context.Cont
17361754
shcPlaybookContext.setLivenessProbeLevel(ctx, livenessProbeLevelOne)
17371755

17381756
// Trigger bundle push
1739-
cmd := fmt.Sprintf(applySHCBundleCmdStr, shcPlaybookContext.searchHeadCaptainURL, shcBundlePushStatusCheckFile)
1757+
adminPwd, err := splutil.GetSpecificSecretTokenFromPod(ctx, shcPlaybookContext.client, shcPlaybookContext.podExecClient.GetTargetPodName(), shcPlaybookContext.cr.GetNamespace(), "password")
1758+
if err != nil {
1759+
scopedLog.Error(err, "failed to retrieve admin password from pod secret")
1760+
return err
1761+
}
1762+
cmd := fmt.Sprintf(applySHCBundleCmdStr, shcPlaybookContext.searchHeadCaptainURL, adminPwd, shcBundlePushStatusCheckFile)
17401763
scopedLog.Info("Triggering bundle push", "command", cmd)
17411764
streamOptions := splutil.NewStreamOptionsObject(cmd)
17421765
stdOut, stdErr, err := shcPlaybookContext.podExecClient.RunPodExecCommand(ctx, streamOptions, []string{"/bin/sh"})
@@ -1889,7 +1912,12 @@ func (idxcPlaybookContext *IdxcPlaybookContext) isBundlePushComplete(ctx context
18891912
reqLogger := log.FromContext(ctx)
18901913
scopedLog := reqLogger.WithName("isBundlePushComplete").WithValues("crName", idxcPlaybookContext.cr.GetName(), "namespace", idxcPlaybookContext.cr.GetNamespace())
18911914

1892-
streamOptions := splutil.NewStreamOptionsObject(idxcShowClusterBundleStatusStr)
1915+
adminPwd, err := splutil.GetSpecificSecretTokenFromPod(ctx, idxcPlaybookContext.client, idxcPlaybookContext.podExecClient.GetTargetPodName(), idxcPlaybookContext.cr.GetNamespace(), "password")
1916+
if err != nil {
1917+
scopedLog.Error(err, "failed to retrieve admin password from pod secret")
1918+
return false
1919+
}
1920+
streamOptions := splutil.NewStreamOptionsObject(fmt.Sprintf(idxcShowClusterBundleStatusStr, adminPwd))
18931921
stdOut, stdErr, err := idxcPlaybookContext.podExecClient.RunPodExecCommand(ctx, streamOptions, []string{"/bin/sh"})
18941922
if err == nil && strings.Contains(stdOut, "cluster_status=None") && !strings.Contains(stdOut, "last_bundle_validation_status=failure") {
18951923
scopedLog.Info("IndexerCluster Bundle push complete")
@@ -1912,7 +1940,12 @@ func (idxcPlaybookContext *IdxcPlaybookContext) triggerBundlePush(ctx context.Co
19121940

19131941
// Reduce the liveness probe level
19141942
idxcPlaybookContext.setLivenessProbeLevel(ctx, livenessProbeLevelOne)
1915-
streamOptions := splutil.NewStreamOptionsObject(applyIdxcBundleCmdStr)
1943+
adminPwd, err := splutil.GetSpecificSecretTokenFromPod(ctx, idxcPlaybookContext.client, idxcPlaybookContext.podExecClient.GetTargetPodName(), idxcPlaybookContext.cr.GetNamespace(), "password")
1944+
if err != nil {
1945+
scopedLog.Error(err, "failed to retrieve admin password from pod secret")
1946+
return err
1947+
}
1948+
streamOptions := splutil.NewStreamOptionsObject(fmt.Sprintf(applyIdxcBundleCmdStr, adminPwd))
19161949
stdOut, stdErr, err := idxcPlaybookContext.podExecClient.RunPodExecCommand(ctx, streamOptions, []string{"/bin/sh"})
19171950

19181951
// If the error is due to a bundle which is already present, don't do anything.
@@ -2068,12 +2101,17 @@ func handleEsappPostinstall(rctx context.Context, preCtx *premiumAppScopePlayboo
20682101
var command string
20692102

20702103
// Create CLI command
2104+
adminPwd, err := splutil.GetSpecificSecretTokenFromPod(rctx, preCtx.client, preCtx.localCtx.podExecClient.GetTargetPodName(), cr.GetNamespace(), "password")
2105+
if err != nil {
2106+
scopedLog.Error(err, "failed to retrieve admin password from pod secret")
2107+
return err
2108+
}
20712109
sslEn := getSslCliOption(appSrcSpec)
20722110
if cr.GetObjectKind().GroupVersionKind().Kind != "SearchHeadCluster" {
2073-
command = fmt.Sprintf("/opt/splunk/bin/splunk search '| essinstall --ssl_enablement %s' -auth admin:`cat /mnt/splunk-secrets/password`", sslEn)
2111+
command = fmt.Sprintf("/opt/splunk/bin/splunk search '| essinstall --ssl_enablement %s' -auth admin:%s", sslEn, adminPwd)
20742112
} else {
20752113
// Pass an extra parameter for SHC deployer in post install command
2076-
command = fmt.Sprintf("/opt/splunk/bin/splunk search '| essinstall --ssl_enablement %s --deployment_type shc_deployer' -auth admin:`cat /mnt/splunk-secrets/password`", sslEn)
2114+
command = fmt.Sprintf("/opt/splunk/bin/splunk search '| essinstall --ssl_enablement %s --deployment_type shc_deployer' -auth admin:%s", sslEn, adminPwd)
20772115
}
20782116

20792117
streamOptions := splutil.NewStreamOptionsObject(command)

‎pkg/splunk/enterprise/afwscheduler_test.go‎

Lines changed: 37 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2488,6 +2488,12 @@ func TestPodCopyWorkerHandler(t *testing.T) {
24882488

24892489
func TestIDXCRunPlaybook(t *testing.T) {
24902490
ctx := context.TODO()
2491+
2492+
savedGetSpecificSecretTokenFromPod := splutil.GetSpecificSecretTokenFromPod
2493+
defer func() { splutil.GetSpecificSecretTokenFromPod = savedGetSpecificSecretTokenFromPod }()
2494+
splutil.GetSpecificSecretTokenFromPod = func(ctx context.Context, c splcommon.ControllerClient, podName string, namespace string, secretToken string) (string, error) {
2495+
return "changeme", nil
2496+
}
24912497
cr := enterpriseApi.ClusterManager{
24922498
TypeMeta: metav1.TypeMeta{
24932499
Kind: "ClusterManager",
@@ -2542,8 +2548,8 @@ func TestIDXCRunPlaybook(t *testing.T) {
25422548
// now replace the pod exec client with our mock client
25432549
podExecCommands := []string{
25442550
fmt.Sprintf(cmdSetFilePermissionsToRW, idxcAppsLocationOnClusterManager),
2545-
applyIdxcBundleCmdStr,
2546-
idxcShowClusterBundleStatusStr,
2551+
fmt.Sprintf(applyIdxcBundleCmdStr, "changeme"),
2552+
fmt.Sprintf(idxcShowClusterBundleStatusStr, "changeme"),
25472553
}
25482554
mockPodExecReturnContexts := []*spltest.MockPodExecReturnContext{
25492555
{
@@ -2839,6 +2845,12 @@ func TestSetLivenessProbeLevelForIDXC(t *testing.T) {
28392845

28402846
func TestSHCRunPlaybook(t *testing.T) {
28412847
ctx := context.TODO()
2848+
2849+
savedGetSpecificSecretTokenFromPod := splutil.GetSpecificSecretTokenFromPod
2850+
defer func() { splutil.GetSpecificSecretTokenFromPod = savedGetSpecificSecretTokenFromPod }()
2851+
splutil.GetSpecificSecretTokenFromPod = func(ctx context.Context, c splcommon.ControllerClient, podName string, namespace string, secretToken string) (string, error) {
2852+
return "changeme", nil
2853+
}
28422854
cr := &enterpriseApi.SearchHeadCluster{
28432855
TypeMeta: metav1.TypeMeta{
28442856
Kind: "SearchHeadCluster",
@@ -4387,6 +4399,12 @@ func TestGetTelAppNameExtension(t *testing.T) {
43874399
func TestAddTelAppCMaster(t *testing.T) {
43884400
ctx := context.TODO()
43894401

4402+
savedGetSpecificSecretTokenFromPod := splutil.GetSpecificSecretTokenFromPod
4403+
defer func() { splutil.GetSpecificSecretTokenFromPod = savedGetSpecificSecretTokenFromPod }()
4404+
splutil.GetSpecificSecretTokenFromPod = func(ctx context.Context, c splcommon.ControllerClient, podName string, namespace string, secretToken string) (string, error) {
4405+
return "changeme", nil
4406+
}
4407+
43904408
// Define CRs
43914409
cmCr := &enterpriseApiV3.ClusterMaster{
43924410
TypeMeta: metav1.TypeMeta{
@@ -4403,7 +4421,7 @@ func TestAddTelAppCMaster(t *testing.T) {
44034421
// Define mock podexec context
44044422
podExecCommands := []string{
44054423
fmt.Sprintf(createTelAppNonShcString, telAppConfString, telAppDefMetaConfString),
4406-
telAppReloadString,
4424+
fmt.Sprintf(telAppReloadString, "changeme"),
44074425
}
44084426

44094427
mockPodExecReturnContexts := []*spltest.MockPodExecReturnContext{
@@ -4427,7 +4445,7 @@ func TestAddTelAppCMaster(t *testing.T) {
44274445
// Test shc
44284446
podExecCommands = []string{
44294447
fmt.Sprintf(createTelAppShcString, shcAppsLocationOnDeployer, shcAppsLocationOnDeployer, telAppConfString, shcAppsLocationOnDeployer, telAppDefMetaConfString, shcAppsLocationOnDeployer),
4430-
fmt.Sprintf(applySHCBundleCmdStr, GetSplunkStatefulsetURL(shcCr.GetNamespace(), SplunkSearchHead, shcCr.GetName(), 0, false), "/tmp/status.txt"),
4448+
fmt.Sprintf(applySHCBundleCmdStr, GetSplunkStatefulsetURL(shcCr.GetNamespace(), SplunkSearchHead, shcCr.GetName(), 0, false), "changeme", "/tmp/status.txt"),
44314449
}
44324450

44334451
mockPodExecClient.AddMockPodExecReturnContexts(ctx, podExecCommands, mockPodExecReturnContexts...)
@@ -4500,6 +4518,12 @@ func TestAddTelAppCMaster(t *testing.T) {
45004518
func TestAddTelAppCManager(t *testing.T) {
45014519
ctx := context.TODO()
45024520

4521+
savedGetSpecificSecretTokenFromPod := splutil.GetSpecificSecretTokenFromPod
4522+
defer func() { splutil.GetSpecificSecretTokenFromPod = savedGetSpecificSecretTokenFromPod }()
4523+
splutil.GetSpecificSecretTokenFromPod = func(ctx context.Context, c splcommon.ControllerClient, podName string, namespace string, secretToken string) (string, error) {
4524+
return "changeme", nil
4525+
}
4526+
45034527
// Define CRs
45044528
cmCr := &enterpriseApi.ClusterManager{
45054529
TypeMeta: metav1.TypeMeta{
@@ -4516,7 +4540,7 @@ func TestAddTelAppCManager(t *testing.T) {
45164540
// Define mock podexec context
45174541
podExecCommands := []string{
45184542
fmt.Sprintf(createTelAppNonShcString, telAppConfString, telAppDefMetaConfString),
4519-
telAppReloadString,
4543+
fmt.Sprintf(telAppReloadString, "changeme"),
45204544
}
45214545

45224546
mockPodExecReturnContexts := []*spltest.MockPodExecReturnContext{
@@ -4540,7 +4564,7 @@ func TestAddTelAppCManager(t *testing.T) {
45404564
// Test shc
45414565
podExecCommands = []string{
45424566
fmt.Sprintf(createTelAppShcString, shcAppsLocationOnDeployer, shcAppsLocationOnDeployer, telAppConfString, shcAppsLocationOnDeployer, telAppDefMetaConfString, shcAppsLocationOnDeployer),
4543-
fmt.Sprintf(applySHCBundleCmdStr, GetSplunkStatefulsetURL(shcCr.GetNamespace(), SplunkSearchHead, shcCr.GetName(), 0, false), "/tmp/status.txt"),
4567+
fmt.Sprintf(applySHCBundleCmdStr, GetSplunkStatefulsetURL(shcCr.GetNamespace(), SplunkSearchHead, shcCr.GetName(), 0, false), "changeme", "/tmp/status.txt"),
45444568
}
45454569

45464570
mockPodExecClient.AddMockPodExecReturnContexts(ctx, podExecCommands, mockPodExecReturnContexts...)
@@ -4696,6 +4720,12 @@ func TestIsAppAlreadyInstalled(t *testing.T) {
46964720
},
46974721
}
46984722

4723+
savedGetSpecificSecretTokenFromPod := splutil.GetSpecificSecretTokenFromPod
4724+
defer func() { splutil.GetSpecificSecretTokenFromPod = savedGetSpecificSecretTokenFromPod }()
4725+
splutil.GetSpecificSecretTokenFromPod = func(ctx context.Context, c splcommon.ControllerClient, podName string, namespace string, secretToken string) (string, error) {
4726+
return "changeme", nil
4727+
}
4728+
46994729
for _, tt := range tests {
47004730
t.Run(tt.name, func(t *testing.T) {
47014731
// Create a test CR
@@ -4718,7 +4748,7 @@ func TestIsAppAlreadyInstalled(t *testing.T) {
47184748
}
47194749

47204750
// Add the mock command and return context - use the exact command pattern
4721-
command := "/opt/splunk/bin/splunk list app testapp -auth admin:`cat /mnt/splunk-secrets/password`| grep ENABLED"
4751+
command := "/opt/splunk/bin/splunk list app testapp -auth admin:changeme| grep ENABLED"
47224752
mockPodExecClient.AddMockPodExecReturnContexts(ctx, []string{command}, mockReturnContext)
47234753

47244754
// Call the function

‎pkg/splunk/enterprise/names.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -106,15 +106,15 @@ const (
106106

107107
manualAppUpdateCMStr = "splunk-%s-manual-app-update"
108108

109-
applySHCBundleCmdStr = "/opt/splunk/bin/splunk apply shcluster-bundle -target https://%s:8089 -auth admin:`cat /mnt/splunk-secrets/password` --answer-yes -push-default-apps true &> %s &"
109+
applySHCBundleCmdStr = "/opt/splunk/bin/splunk apply shcluster-bundle -target https://%s:8089 -auth admin:%s --answer-yes -push-default-apps true &> %s &"
110110

111111
shcBundlePushCompleteStr = "Bundle has been pushed successfully to all the cluster members.\n"
112112

113113
shcBundlePushStatusCheckFile = "/operator-staging/appframework/.shcluster_bundle_status.txt"
114114

115-
applyIdxcBundleCmdStr = "/opt/splunk/bin/splunk apply cluster-bundle -auth admin:`cat /mnt/splunk-secrets/password` --skip-validation --answer-yes"
115+
applyIdxcBundleCmdStr = "/opt/splunk/bin/splunk apply cluster-bundle -auth admin:%s --skip-validation --answer-yes"
116116

117-
idxcShowClusterBundleStatusStr = "/opt/splunk/bin/splunk show cluster-bundle-status -auth admin:`cat /mnt/splunk-secrets/password`"
117+
idxcShowClusterBundleStatusStr = "/opt/splunk/bin/splunk show cluster-bundle-status -auth admin:%s"
118118

119119
idxcBundleAlreadyPresentStr = "No new bundle will be pushed. The cluster manager and peers already have this bundle"
120120

@@ -207,7 +207,7 @@ access = read : [ * ], write : [ admin ]
207207
createTelAppShcString = "mkdir -p %s/app_tel_for_sok/default/; mkdir -p %s/app_tel_for_sok/metadata/; printf '%%s' \"%s\" > %s/app_tel_for_sok/default/app.conf; printf '%%s' \"%s\" > %s/app_tel_for_sok/metadata/default.meta"
208208

209209
// Command to reload app configuration
210-
telAppReloadString = "curl -k -u admin:`cat /mnt/splunk-secrets/password` https://localhost:8089/services/apps/local/_reload"
210+
telAppReloadString = "curl -k -u admin:%s https://localhost:8089/services/apps/local/_reload"
211211

212212
// Name of the telemetry configmap: <namePrefix>-manager-telemetry
213213
telConfigMapTemplateStr = "%smanager-telemetry"

‎pkg/splunk/test/util.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -179,3 +179,8 @@ func (client *MockPodExecClient) SetTargetPodName(ctx context.Context, targetPod
179179
func (client *MockPodExecClient) GetTargetPodName() string {
180180
return client.TargetPodName
181181
}
182+
183+
// GetClient returns the ControllerClient from MockPodExecClient
184+
func (client *MockPodExecClient) GetClient() splcommon.ControllerClient {
185+
return client.Client
186+
}

‎pkg/splunk/util/util.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -256,6 +256,7 @@ type PodExecClientImpl interface {
256256
GetTargetPodName() string
257257
GetCR() splcommon.MetaObject
258258
SetCR(splcommon.MetaObject)
259+
GetClient() splcommon.ControllerClient
259260
}
260261

261262
// blank assignment to implement PodExecClientImpl
@@ -332,6 +333,11 @@ func (podExecClient *PodExecClient) SetCR(cr splcommon.MetaObject) {
332333
podExecClient.cr = cr
333334
}
334335

336+
// GetClient returns the ControllerClient from the PodExecClient
337+
func (podExecClient *PodExecClient) GetClient() splcommon.ControllerClient {
338+
return podExecClient.client
339+
}
340+
335341
// NewStreamOptionsObject return a new streamoptions object for the given command
336342
func NewStreamOptionsObject(command string) *remotecommand.StreamOptions {
337343
return &remotecommand.StreamOptions{

0 commit comments

Comments
 (0)